Technology

Except for neverssl.com

Triggering the launch of captive portals for public Wi-Fi users everywhere yayy

People behave as if having a green lock icon were enough to consider you're safe.

People behave as if there were not multiple cases of abuse of PKI.

People behave as if all those whistleblowing cases exposing widespread illegal activities by the state were not treated as normal, except those exposing them being chased and vilified.

What I'm trying to say is that we're past the stage where techno-optimism about the Internet made sense. They just say in the news that abusing you is good, and everybody just takes it.

Oh man, I forgot about startssl until just now. I definitely had a few of those certs. If you wanted something fancy like a wildcard cert back then, you were paying $$$

Private sector is more efficient my ass

Well, it's difficult, as it should be, because if you control a certificate in the active chain of trust of browsers, you can hack pretty much anything you want.

Cloudflare sort of provides this now by being a MITM to secure your site between your server and the end user. But this requires you and your end user to trust Cloudflare.

And fwiw the ACME protocol is open so anyone can implement it. I believe even the ACME software that EFF sends out allows you to choose your server with some configuration.

I'd also argue that the fact that it's 100% automated and their software is open source makes it objectively more secure. On the issuing side, there's no room for human error, social engineering, etc.

They also made it a open protocol (the ACME protocol), so now there's a bunch of certificate providers that implement the same protocol and thus can work with the same client apps (Certbot, acme.sh, etc). I know Sectigo and GoDaddy support ACME at least. So even if you don't use Let's Encrypt, you can still benefit from their work.

It won't be that simple.

For starters, you're assuming t-zero response. It'll likely be a week before people worry enough that LE isn't returning before they act. Then they have to find someone else for, possibly, the hundreds or thousands of certs they are responsible for. Set up processes with them. Hope that this new provide is able to cope with the massive, MASSIVE surge in demand without falling over themselves.

And that's assuming your company knows all its certs. That they haven't changed staff and lost knowledge, or outsourced IT (in which case they provider is likely staggering under the weight of all their clients demanding instant attention) and all that goes with that. Automation is actually bad in this situation because people tend to forget how stuff was done until it breaks. It's very likely that many certs will simply expire because they were forgotten about and the first thing some companies knows is when customers start complaining.

LetsEncrypt is genuinely brilliant, but we've all added a massive single point of failure into our systems by adopting it.

(Yeah, I've written a few disaster plans in my time. Why do you ask?)